OpenAI Says People Linked to China's Moonshot Tried to Copy Its AI's Hidden Reasoning

What it claims

OpenAI says it disrupted a coordinated campaign, active from July 1 to July 28, that tried to extract the encrypted reasoning its models produce before answering. OpenAI says the campaign worked within normal use and did not break anything:

"The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations. Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester."

OpenAI's stated concern is that reasoning traces carry information the final answer leaves out. That would let another model be trained on them without the original model's safeguards. OpenAI defines "adversarial distillation" as "the systematic and unauthorized use of one model's outputs or reasoning to help train, reproduce, or improve another model."

How it works

The page names only one technique. An attacker takes an encrypted reasoning blob from one conversation, pastes it into a different conversation, and asks the model to decode it. Whoever held a blob, including one belonging to another user, could recover its plaintext. OpenAI says it has closed this replay pathway. The page gives no other methods.

Evidence

• The page cites August research showing that OpenAI, Anthropic and Google each encrypted reasoning with a single provider-wide key.
• The same research showed that models could be coaxed into emitting their hidden reasoning as plain text.
• All three providers deployed server-side patches after disclosure. However, session logs shared before the patches remain decodable.
• In February, Anthropic said its Claude abuse case involved about 24,000 fraudulent accounts generating more than 16 million exchanges.

Limits

• Check your stored blobs. If you store, log, or share encrypted reasoning items from these providers, blobs created before the patches should be treated as recoverable plaintext. Server-side fixes do not protect artifacts that already left your system.
• No technical detail on detection. The page does not say how OpenAI detected the campaign, how the replay fix works, or whether the provider-wide key design has changed beyond the patches.
• Attribution is partial and one-sided.
• OpenAI attributes only a "core cluster" to individuals associated with Moonshot AI.
• OpenAI says it is unclear whether all operators came from a single actor.
• Moonshot had not responded when the piece was written.
• Unexplained reference. The article mentions that OpenAI's post "doesn't connect the campaign to K3" but never explains what K3 is.
• Secondhand source. This is news coverage of an OpenAI post, not the primary disclosure. Go to OpenAI's post for anything beyond these claims.